cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
987
Views
0
Helpful
8
Replies

Display which user is using what (C3750)

solferry1
Level 1
Level 1

Hi,

I was trying to check on a C3750 Router to see the traffic comming through this router.

My goal was to see which ip-address is using the most bandwidth and also which ports he/she is using.

We seem to have a downloader in our company and we want to know which computer is utilizing our bandwidth.

Anyone has an idea how to check for this?

Thanks in Advance.

8 Replies 8

Jan Nejman
Level 3
Level 3

Hello,

the best for this issue is using a NetFlow. But NetFlow is not supported on your 3750. Do you have any other Cisco device, i.e. router for communication with your ISP?

Jan

Caligare, Co.

http://www.caligare.com/

Hi Jan,

We do have an ISP router for MPLS, but we don't have access to it unfortunately.

I tried to figure out some ip accounting statements, but it didn't got me what I want.

Maybe SNMP?

yjdabear
VIP Alumni
VIP Alumni

When NetFlow is not available, another albeit more costly option is to connect a RMON2 probe to the 3750 and span the traffic to that port.

Thanks for the idea, at the moment we don't have any intention for hardware investments, and ofcoures I was just curious what the right way is for issues like these, there i can imagen I am not the only one dealing with users on the network trying to download and using bandwidth intensively.

I will continue my quest, and ofcourse update this topic when I have found an answer.

Thanks.

If you do not have any management software etc... get a free one ... mtrg or mrtg is a good one.

glen.grant
VIP Alumni
VIP Alumni

On a moment to moment basis you can use the command " show controllers utilization " and this will show you the utilization for each and every port , if you see one using more than the others then just do a "show mac-address for the port then look in the arp table for the address and you have your user , but this is a manual process and the user would have to be doing something at the time in order to see it . This command is very useful though for looking at things and to see how busy the stack ring is if it is a 3750 stack. you can also clear counters then use the command "show interface counters and see who has tranferred the most amount of packets in the period since you cleared counters.

Hope the counters will work, I think I can get along with the things you suggest, thanks very much!

I tried the IP Accounting, but it looks like this is disabled/not supported on the 3750, this controller utilization thing is going to do the job i guess.

Thanks very much!

Else the solution would be some kind of SMTP program to fetch the data.. also nice, but I like to be in control :).

davehedgehog
Level 1
Level 1

Here's what I do. I can't remember the commands but i'll look them up if you need me to.

Say your WAN connection is on fa0/1 and your pc is on fa0/2. You can set the switch to send all the frames that would be destined to go out via fa0/1 to also go out via fa0/2.

When you think someone is abusing the WAN connection, just enable this command and run Ethereal on your PC to sniff exactly what is going out on the WAN connection.

will this do the trick?

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Innovations in Cisco Full Stack Observability - A new webinar from Cisco